CVE-2024-1766

The Download Manager plugin contains a stored cross-site scripting vulnerability affecting versions up to 3.2.86, where user display names are not properly sanitized or escaped. Authenticated users with subscriber privileges or higher can inject malicious scripts that execute when pages containing the injected content are viewed. Exploitation requires social engineering to trick someone into logging in with a compromised account, limiting the practical impact of this flaw.

Based on public CVE data (MITRE/NVD).